reply-api

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches documentation and endpoint specifications from docs.reply.io. As this domain is owned by the vendor (reply-team), these references are documented as standard operational behavior for fetching necessary metadata and guidelines.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks because it instructs the agent to fetch and follow instructions from external markdown files (https://docs.reply.io/api-reference/*.md) and a text index (https://docs.reply.io/llms.txt) to determine the structure and execution of API calls.
  • Ingestion points: External documentation fetched via HTTPS in SKILL.md.
  • Boundary markers: None identified; external content is used directly to formulate command arguments.
  • Capability inventory: The skill uses the reply-cli to perform potentially sensitive state-changing operations (POST, PATCH, DELETE) on the Reply.io platform, as noted in the Execution Guidance and Safety sections.
  • Sanitization: No explicit sanitization or validation of the fetched documentation content is described before it is used to construct shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 06:47 PM
Security Audit — agent-trust-hub — reply-api